Extracted

• • Target
    d8a047f6201766e5e3fbab78a017a055e5bbc9d9b5e53883eb07b27db6d06c48.bin
  • Size 26.3MB
  • SHA256 d8a047f6201766e5e3fbab78a017a055e5bbc9d9b5e53883eb07b27db6d06c48
  • MD5 422bdf2d372f11fe15f51c38ad1bbc5d
  • SHA1 53061609767be91ba692c7928ea257556bf05766
  • SHA512 f6199fdc5c55aa83c5f7ebb7b97b83b0714293535b76944db01bea9f61d34e9593df520faa755ee06697f80ec5ff43096b6700f594e26f22b36f2edb8785023b
  • SSDEEP 1536:z1oGpSTUIr8R7SUBCJHlb0WZ3P78Yi2POynfffWMWlESK473V4HzUbSn0GZ1aiM1:obH2
  • TLSH
    T116575FA4C318D1F2D5835C74C169FFE99E857A1B84EB101EA28011CE0BFADC568EF796
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cal09discoveryexecutionasyncratratsuricata

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2